DemandScience Exposes 122 Million Business Contacts in Legacy‑System Breach
What Happened
In early 2024 a data set from DemandScience (owned by Pure Incubation) appeared for sale on a hacking forum. The leak originated from a decommissioned legacy system and contained more than 121 million records of business contact information, including corporate email addresses, phone numbers, physical addresses, employers, job titles, names and LinkedIn profile links.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the risk of unmanaged legacy assets; continuous control‑assurance programs must inventory, secure, and properly retire all data stores.
- Highlights the need for documented data‑handling policies that cover publicly sourced information as personally identifiable information (PII) under many privacy regimes.
- Provides a real‑world example of why evidence‑driven monitoring (e.g., automated discovery and classification) is essential for audit‑ready breach response.
Who Is Affected
- B2B marketing and lead‑generation firms
- Recruiting and staffing agencies
- Enterprise CRM and sales‑enablement platforms
- Any organization that purchased or relied on DemandScience’s contact database
Recommended Actions
- Review any contracts or data feeds received from DemandScience and assess exposure of the disclosed fields.
- Validate that continuous monitoring controls (asset discovery, data‑classification, and decommissioning workflows) are in place and documented.
- Request a formal incident‑response disclosure from DemandScience, including timelines, remediation steps, and evidence of data‑destruction.
Technical Notes
- Attack vector: Leak from a decommissioned legacy system; likely unauthorized extraction of stored data without proper sanitization.
- CVEs: None reported.
- Data types exposed: Email addresses, names, employers, job titles, phone numbers, physical addresses, social‑media (LinkedIn) profiles.
Source: https://haveibeenpwned.com/api/v3/breach/DemandScience